5G will dramatically increase the number of devices connected to the Internet—and the number of opportunities for hackers to steal information and wreak havoc on connected systems.
The Administration issued a National Strategy to Secure 5G, which GAO assessed against 6 key characteristics for effective national strategies.
The plan only partially addressed 5 of the 6 characteristics. For example, it didn’t say what resources are needed to carry the plan out—which can make it hard to allocate and shift resources appropriately.
The Government Accountability Office recommended that Administration officials ensure the strategy fully addresses all 6 characteristics.
The federal government and private industry are preparing for the next generation of wireless technology, known as the fifth generation of mobile communication networks, or 5G. 5G is expected to introduce national security risks as malicious actors seek to exploit these new 5G technologies. In March 2020, the White House issued the National Strategy to Secure 5G of the United States of America (5G national strategy), as required by the Secure 5G and Beyond Act of 2020 (P.L. 116-129). The strategy is intended to provide direction on how the U.S. government will secure 5G infrastructure domestically and abroad. GAO identified six desirable characteristics of an effective national strategy and found that the strategy partially addresses five of these six characteristics and does not address one.
As an example, GAO found that the 5G strategy partially addresses the problem definition and risk assessment characteristic. The 5G strategy includes some of the elements, such as information on the problem that it is intended to address and broadly identifies underlying vulnerabilities, threats, and risks. However, it does not include other elements, such as a risk assessment or complete information on 5G risks. In another example, GAO found that the 5G strategy does not address the characteristic of results, investments, and risk management. Specifically, the strategy does not explicitly discuss what it will cost and does not include any cost estimates either for achieving individual goals or for implementing the strategy as a whole.
GAO found that the 5G national strategy does not include all elements of the six desirable characteristics of national strategies because, according to officials from the White House’s Office of Science and Technology Policy (OSTP) and the National Telecommunications and Information Administration (NTIA), the strategy was intentionally written to be at a high level. According to these officials, the 5G implementation plan, also required to be submitted by September 23, 2020 by the Secure 5G and Beyond Act of 2020, is expected to include specific details not covered in the 5G national strategy. The National Security Council (NSC) and National Economic Council (NEC) are developing the implementation plan and according to NTIA officials, it is expected to be finalized by the end of October 2020. NTIA and OSTP officials were uncertain of its final content and did not provide information about whether the plan would include all elements of the six desirable characteristics of national strategies. Until the Administration assures that the implementation plan fully addresses all elements of the six desirable characteristics, the plan will provide limited guidance to decision makers about allocating resources to address 5G risks and challenges.
GAO recommended that the Assistant to the President for National Security Affairs, in coordination with relevant stakeholders from NSC and NEC, should ensure that the plan to implement the 5G national strategy fully addresses all elements of GAO’s six desirable characteristics of a national strategy. NSC and NEC did not provide a response to a draft copy of this report.
